From e27330be63cba9c71ffec392457800f8c74a689a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Badenes?= Date: Thu, 27 Aug 2026 13:37:07 -0300 Subject: [PATCH] ci: bump sigstore action to v3.5.0 sigstore/gh-action-sigstore-python@v3.0.0 installs sigstore-python ~= 3.0, whose embedded Sigstore TUF root predates the production root rotation, so signing fails with "root was signed by 0/3 keys". v3.5.0 pins sigstore 4.5.0 and tuf 7.0.0, which trust the current root. Also set skip-existing on the PyPI publish step: without it, re-running the workflow after a failure in a later job dies on the already-uploaded version instead of getting to the step that actually failed. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-and-publish.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-and-publish.yaml b/.github/workflows/build-and-publish.yaml index bdfbd89..079c783 100644 --- a/.github/workflows/build-and-publish.yaml +++ b/.github/workflows/build-and-publish.yaml @@ -59,6 +59,10 @@ jobs: path: dist/ - name: Publish distribution 📦 to PyPI uses: pypa/gh-action-pypi-publish@release/v1 + with: + # A re-run of this workflow (e.g. after a later job fails) would + # otherwise die here because the version is already on PyPI. + skip-existing: true # Only sign and upload to GitHub Release after publishing to PyPI github-release: @@ -78,7 +82,7 @@ jobs: name: python-package-distributions path: dist/ - name: Sign the dists with Sigstore - uses: sigstore/gh-action-sigstore-python@v3.0.0 + uses: sigstore/gh-action-sigstore-python@v3.5.0 with: inputs: >- ./dist/*.tar.gz